IIS7: Manipulate headers for html files in Classic mode - html

Question

I'm using an angular directive to pull an html file from my IIS7 classic mode server (classic required due to SSO). To satisfy CORS I need read the ORGIN from the request and add a header to the response of the html file. That bit doesn't really matter. My problem is hooking in my code to actually do this for a static HTML file.
So with classic mode my handlers/module are defined in system.web, not system.webSever. Therefore I can't use the runAllManagedModulesForAllRequests="true" flag which isn't part of the schema for system.web.
In system.web I have:
<httpHandlers>
<!--<add path="*.html" verb="GET,HEAD" type="System.Web.StaticFileHandler" />-->
<add path="*.html" verb="GET,HEAD" type="My.Namespace.CrossOriginHandler, My.DLL.Name" />
<add path="*" verb="*" type="System.Web.HttpNotFoundHandler" />
</httpHandlers>
<httpModules>
<add name="CrossOriginModule" type="My.Namespace.CrossOriginModule, My.Dll.name" />
</httpModules>
This executes fine for a MVC pages or webapi calls. It does not execute for my static HTML file.
I'm starting to fear I'm going to need to write a custom ISAPI filter. Is there any other way to hook in my code? A configuration I'm missing or hook inbetween ISAPI filter and HttpModule?

Answer 1

There are a couple of options you have and definitely you should not need to write an ISAPI for that.
One option if you can set it for everyone blindly is to just use the httpProtocol section to add the header:
<system.webServer>
<httpProtocol>
<customHeaders>
<add name="Access-Control-Allow-Origin" value="*" />
</customHeaders>
</httpProtocol>
</system.webServer>
however, a much better option is to use URL Rewrite to set the headers and still have all the control to check for origins, and rewrite them appropriately.
I wrote a quick article on how to do that here:
http://www.carlosag.net/articles/enable-cors-access-control-allow-origin.cshtml
At a high level it means adding a URL Rewrite inbound rule to capture the Origin header and set it in a server variable. Then you can use that server variable later in an outbound rule to set it in a header. Optionally I used a Rewrite Map to condition the origins that you wanted to allow that.
<outboundRules>
<rule name="Set-Access-Control-Allow-Origin for known origins">
<match serverVariable="RESPONSE_Access-Control-Allow-Origin" pattern=".+" negate="true" />
<conditions>
<add input="{AllowedOrigins:{CAPTURED_ORIGIN}}" pattern=".+" />
</conditions>
<action type="Rewrite" value="{C:0}" />
</rule>
</outboundRules>
see full explanation here: http://www.carlosag.net/articles/enable-cors-access-control-allow-origin.cshtml